Show Notes
We can all agree that software security is more important than ever. But even
startups that specialize in security face challenges, especially for first-time
founders. IriusRisk is a perfect example of that. This Spanish-born startup
plans one step ahead by predicting security issues software may face before one
line of code is written.
IriusRisk CEO and co-founder Stephen de Vries recently spoke with midstage
startup coach Roland Siebelink on the Midstage Startup Momentum Podcast. About
the challenges of being a first-time founder and the important lessons he’s
learned along the way.
- Why starting out as a consultant agency has benefited IriusRisk.
- How IriusRisk developed a more serious channel strategy.
- How to know when it’s time to hire a game-changer in a particular department.
- How IriusRisk has managed to keep the CEO and VP of products separate roles.
- The best practices for inspiring employees from different departments.
- How Stephen has adapted from being on the technical side of things to being a CEO.
Transcript
Roland Siebelink:Hello and welcome to the Midstage Startup Momentum
Podcast. My name is Roland Siebelink and my co-host is Carlos Founaud. And
today, we have with you Stephen de Vries, who is the CEO and founder of
IriusRisk. Hello, Stephen.
Stephen de Vries:Hello, Carlos and Roland. Great to be here.
Roland Siebelink:Excellent. Well, thank you for joining. IriusRisk was born
in Spain. That's where Carlos discovered them. Carlos, where did you first hear
of IriusRisk?
Carlos Founaud:Well, I first learned about them in Huesca, in the north of
Spain. And what fascinated me was there were two people, Stephen and Cristina,
working in Huesca. At the same time, they had a guy, I think in South Africa,
another one in Brazil, something like that. But then the story of the name
IriusRisk got me. They were telling me Irius is a famous vineyard here in Spain.
And it was the first thing they could see through the window, and there was
Irius and they just added risk to the name. And that's how I met him. They were
our neighbors in Huesca.
Roland Siebelink:That's very, very awesome. The first startup that I know
is named after a vineyard. That's amazing. Stephen, what does Irius do? How do
you see your origin story from that vineyard in Spain and where you are now,
based in Atlanta and all over the world? Tell us.
Stephen de Vries:Our focus area is software security called threat
modeling, secure design. What we build is a platform that allows engineers,
security architects, solution architects to easily find out what does a secure
design of their application look like before they even start writing a line of
code. Whereas most application security tools are focused on testing code or
testing an application, we're focused one step earlier at the point where you're
still designing conceptually what does this application look like? What
technologies are you going to use? And based on that design, we can already
predict some security issues or security weaknesses that you probably want to
predict.
Roland Siebelink:That's awesome. And how did you move all the way from that
vineyard in Spain to Atlanta? Now I want to know the full details.
Stephen de Vries:It kind of grew. Just like a vine, if you water it, it
gives a good harvest, it's going to grow. We started off as a consultancy way
back in 2008. My background is more on the technical side of doing pen tests and
training for developers around secure design, secure development. Out of that,
we started building the product in about 2014. We sold our first license that
was big enough for us to stop consulting in about 2015. And from there, landed a
few initial customers. Raised the seed round 2017. Hired our first salesperson
around that time. And then raised our Series A with Paladin Capital and 360
Capital in about August last year. On the basis of that, we then moved to the
US, which is where the majority of our customers are, and to the UK, primarily
in London.
Roland Siebelink:That's awesome. Can you give us a little bit of a feel for
how successful Irius has been so far? Maybe the number of customers or number of
employees, or I don't even know, maybe even the hundreds of offices that you
have already.
Stephen de Vries:These days everybody has virtual offices, right? We could
have 10. We've got three official offices - well four - Huesca, Madrid, London,
and Atlanta. We're 68 employees now. And we've grown more than 120% since last
year. And our year-on-year growth is upwards of 110% year-on-year in terms of
our monthly recurring revenue. It's been exciting. It's been a lot of hard work.
But it's great that we've established some really good relationships with our
customers and that our customers stay with us and keep renewing and keep
expanding.
Carlos Founaud:What type of teams do you have? How do you split them?
Stephen de Vries:We have a technical team based in Spain. We have a small
sales team in Spain. In the UK, we've got mostly sales, marketing, and customer
success and support teams. And then over in the US, we have a purely sales team,
East coast, West coast, and Atlanta.
Carlos Founaud:You have development mostly in Spain?
Stephen de Vries:That's right. We grew up that way. Even though I say it's
in Spain, it's all over Spain.
We grew up like that, working remotely. Carlos, when you met us many years ago,
we had a developer in Brazil who's still with us, Rafael, great developer. And
we hired a few more in Huesca. But then as we kept on hiring, we hired in
Galicia in the North, in the South, in the East, in the West. We've ended up
with a completely remote team, which has really worked out well during this
COVID time. I think companies were quite challenged if they had not already
established this remote working situation, it was a challenging time for them to
adapt. And luckily, we'd already established that as part of our DNA. It was
quite easy for us to adapt to that form of working.
Carlos Founaud:You told me your sales team is mostly in the UK and USA.
What type of customers are you targeting?
Stephen de Vries:That's interesting. We have mostly a good response from
the financial services sector, banking, insurance, FinTech, even some crypto
blockchain companies. And I think that is really due to the characteristics of
those companies and what they want from cybersecurity and what the cybersecurity
challenges are. For our product, we're focused on engineering teams who are
building software. If you want to be a customer of ours and want to get value
out of our tool, you are typically going to care enough about cybersecurity that
you want to invest in secure design.
I think a lot of the companies, maybe in mid-market SMEs, they're just not at
that level of maturity yet. They just want something working. They don't care if
it's got a few security bugs here and there; it's not going to harm their
business too much. Financial services, completely the opposite. They absolutely
care about the security of the software that they build.
Roland Siebelink:What have been your big growth drivers? The things that
have been really driving success for Irius. The things you really feel are some
of your success factors, if you will.
Stephen de Vries:In terms of the market, what has happened is there's a lot
more attention being paid to threat modeling and secure design as a concept.
This concept started, I think, in about 2004. Microsoft published a book on it.
They released a tool and methodology to help engineers think about what they're
going to be building from a design perspective before they go and build it. It's
not a new concept. It's been around for a while. But it hasn't had this amount
of momentum before.
Roland Siebelink:Building on that a little bit, I would like to maybe hone
in a little bit on what are the things you're doing right. The things you're
doing well at IriusRisk to really take advantage of those trends and tailwinds.
What are some of the things, the practices you've developed that you find keep
working really well for you?
Stephen de Vries:I don't know if it's a practice as much as a value that we
have as a company is to stay really close to our customers. And maybe this came
out of the fact that we started off as a consultancy. We were always working
with clients. And when we changed to a product company, that thread in our DNA
stayed there. We do stay really close to our customers. We have regular meetups
with them. We've got a great customer success team who helps them literally be
successful with our product. That they want them to get value out of our
product. I think that's one of the things we're doing well is staying close to
the customer, listening to them, helping them with services where we can. And,
of course, feeding their feedback back into the product.
One of the other things we've also done is we've taken on a more serious channel
strategy, which previously we had done on an ad hoc basis. If a partner phoned
us, we showed them a demo. We showed them the product. But there wasn't really a
push from our end down a channel strategy. We've now hired a channel manager and
he has been focused only on that, only on establishing those relationships. And
I think for me, as a first-time founder, is one of those things that I didn't
really have an appreciation of how much work it is to actually establish those
relationships with the channel.
I just thought, "Well, you show them a demo once. They know what the product is,
and they'll go and sell it if they see an opportunity. It doesn't work like
that. There needs to be a relationship. There needs to be follow up of
opportunities. And our channel manager is handling that at the moment.
Carlos Founaud:How do you manage the teams? You have sales and marketing
teams that are growing, they're in the UK and USA, and then you have techies all
around Spain. Usually, tech guys with marketing guys, sometimes there are some
difficulties understanding. How do you manage the whole thing?
Stephen de Vries:As a company, we've got great heads of teams in place now.
We have our chief revenue officer, our CRO, who oversees all of sales and
marketing. He's got a lot of experience doing that, managing sales teams and
marketing teams, which are quite different animals to technical teams. My
background is more with the technical side, so I'm really glad that he's on
board to help work with the sales and marketing teams.
And the same is true also for the technical team because that team has grown now
to a lot bigger than what it was. Our CTO and our global tech leads now take
charge of all of those technical teams. I just sit back and go to the beach
whenever I like and everybody else is running the company (That is a joke!).
Roland Siebelink:That's the one thing you cannot cut out of the podcast.
Stephen, this chimes with some of the research that the people from Notion VC
did in London, where they said one of the core things you can do to accelerate
your growth is to hire a game-changer. Bring in somebody with experience in
managing a team that you are not that experienced at, especially if they've done
it in a fast growing startup before. Has that been your experience then as well?
And if so, how did you actually accomplish that?
Stephen de Vries:Yes, that has been my experience. I think one of the
challenges for many founders is you don't know what you don't know. When you
think of a sales leader, you're just having your imagination. It's like a
salesperson times two who manages other salespeople. But what that actually
means when you hire a sales leader is that that sales leader can lead a team.
They have established processes. They can motivate a team. They can get the team
to be disciplined about their projected revenues that they're going to close
that month.
I think all of that are the benefits of hiring experts in their area and
bringing them into the company. I'd absolutely agree with that. You absolutely
need to hire game-changers in every department. At different stages of our
growth, we've hired game-changers for that stage. And they've been great
game-changers for that stage. Sometimes they've been game changers for much
longer or sometimes they've only been good for that particular stage.
Roland Siebelink:Many people are great at, let's say zero to 5 million to
five to 15 million or something like that. Often, they even want to stick with
that. They may be around, do a great job for three years and then decide to move
onto the next level, startup or something like that.
Stephen de Vries: Exactly. Somebody described it as if you're colonizing a
new land. The first people that land are the pioneers. The pioneers go in, break
new ground, hack the Bush, and establish a camp. But once you've got a hundred
people in the camp, it's not a camp anymore; it starts becoming a town. Now the
people you need are the town planners who can establish some rules and so on
around the town. And the pioneers, onboard, they don't want to live in the town.
They want to be pioneers.
Roland Siebelink:Two questions about hiring those game-changers because
it's a topic we haven't necessarily discussed in other episodes that much yet.
One, how do you prioritize where you need game-changers most and when? And
second, where do you actually find them?
Stephen de Vries:Good questions. I think you have a gut feel around which
area of the business needs attention. You always want to spend time, energy, and
money in the problem area. If things are going well, you don't necessarily need
to do much therapy. You need to spend on the weak areas so that the whole thing
moves up and the whole thing is supported. I think first identifying where you
are weak, and maybe you as an exec team of a company. What are the elements that
are missing from your experience? That's probably where you need to hire. That's
the experience that you need.
How you go about it, we've used a number of different agencies. Sometimes we
hire through our own networks, people we know through our technical advisory
board members or our larger expanded networks. But sometimes you need to use
agencies and get people there.
Carlos Founaud:How do you decide which are the new features you want to put
in your product?
Stephen de Vries:Good question. The first thing you do is you hire another
game-changing role, which is a VP of product. Rather than that being a decision
that is made very lightly about what new feature comes in, a VP of product to
understand how product work can put some structure behind it. They can talk to
the customer success team and the customer support team. And they can find out
what are the broad themes of problems that we are solving for our customers and
which of those themes is the most priority theme.
In our case, we make threat modeling easier, and let's say we make it faster.
Between easier and faster, which is more important to our customers and which
one of those two things is going to help us sell more licenses of the software.
If it's easier, that's the aspect that we should focus on. Then any features
related to making the software easier should get a higher priority than those
related to making them faster or to make them more stable.
Roland Siebelink:They often say that the VP of products is like a mini CEO.
Also, the hardest VP position to fill. What's been your experience with that?
Stephen de Vries:Yes, that has been a very hard position to fill.
Roland Siebelink:More concretely, maybe, once you did fill the position,
how did you go about separating the CEO role from the VP of products role? And
what challenges did you face in trying to do that?
Stephen de Vries:I don't know if they're completely separated yet. They've
organically grown to be separate roles. I don't think it's down to establishing
any clear cut criteria. We've never had a meeting that said, "Okay, this stuff
is yours. This stuff is the CTOs. This stuff is the CEOs." That has never
happened. The VP of product just started doing product stuff. If he was doing
it, the CTO wasn't doing it, and I wasn't doing it. It just fell into place. I
think it will continue doing so. Maybe as we grow, we may need to have more
clearly delimited roles. But at the moment it just worked out.
Carlos Founaud:Let's say in three to five years’ time you go to IriusRisk's
new headquarters, wherever they are, what do you see? How many people are there?
How many customers? Where are they based? What is your dream?
Stephen de Vries:To be honest, I don't look that far into the future. I really don't
know what this is going to become. And I remember when we had a meeting with a
company that can do R&D grants. And we had this meeting in 2015 when we were
just starting out. We just sold one or two licenses. We had revenues of a
hundred thousand Euros. And this guy, an expert in finance, came out with his
Excel sheets that said: "Okay, you've got a hundred thousand this year. You're
going to grow this much, so in five years’ time, 2020, you're going to be
upwards of 2 million Euros in revenue.
And I laughed in his face. I said, "That's impossible. How can you possibly do
that? Your Excel sheet is doing magic. You can put whatever number you like in
there and come up with answers." It turns out it was true. But I didn't see that
from that perspective. I'm more focused on what we're going to do this year.
What are we going to do next year? And for me, that vision is more focused
around what are we going to do with the product, what we're going to deliver to
our customers. And once we do that, then we'll see where we are then and what
five years out looks like.
Roland Siebelink:Okay. What do you use to inspire your employees about the
big horizon you're pointing them to? This is the mountain we're climbing.
Stephen de Vries:I think that different teams get their inspiration from
different challenges. The technical team has done a tremendous amount of work
with our products. They enjoy their technical challenges, so as long as we give
them the freedom to make technical decisions, to make important decisions - even
if sometimes those are gonna harm the business in the short term. When they say
something like "We're going to throw away this framework we've been using for
the last three years and we're going to use a new JavaScript framework that's
going to open doors for us but it's going to delay product release three or four
months," that's something we need to support.
And we need to say, "Yes, we need to do that." Not only for their own
inspiration and motivation and for their own professional growth but also for
the company's long-term. You can't keep making short-term decisions. You
sometimes have to swallow a bitter pill because you know it's going to help you
further in the long term.
For the sales team, they're often motivated by the types of customers that we
work with. When we land a good account, a big logo, everybody knows. I think
that helps motivate them as well. To see this is the market opportunity. This
type of customer is coming to us and using our software, that helps motivate
them that they've got a big market opportunity in front of them. They can go and
close some interesting deals as well.
Roland Siebelink:We have been recording for mostly 40 minutes now, maybe we
can move to how can our listeners help IriusRisk most. Hearing a great growth
story, a compelling plan for the near future, if not the far future yet. What
can our listeners help you with the most? What do you need from them? Do you
need job applicants? Do you need intros to investors? Do you need everyone in
the world downloading your ROI calculator? What do you need?
Stephen de Vries:Well, that's an interesting one. Intros to investors are
always helpful because we'll probably be raising mid-next-year our series B.
It's always good to meet new partners. What the listeners could also do is they
could try out our free community edition. It's linked to from our website. They
can try out the threat modeling tool and see how it can help them design secure
software. If that's a cloud-based application, or software-based application, or
a mixture of the two, it'll help give them an idea on what are the kinds of
security issues that are going to be facing before they start building that
application.
Of course, if they'd like to work with a startup who's growing rapidly and doing
some interesting work in security design and threat modeling, please get in
touch.
Carlos Founaud:Just to finish, you were a first time CEO, first time
founder, tell me what have you learned?
Stephen de Vries:It's been an amazing experience for me personally because
I never saw myself really, as a CEO of a company. I always saw myself more in
the CTO role, more in a product-centric, technical role. And as I've been doing
it more and more, I've been learning more and more, and I'm feeling more
comfortable in this skin as the CEO of a company. All the things that go along
with a non-technical part of a company: metrics, financials, raising capital,
getting finance, the legal aspects, sales, marketing, all of that was new to me.
It was all things that I had to learn on the job. I can go on and on, but that's
the essence of it. Almost everything that's not technical, that's new and that
stuff I learned while in this role.
Roland Siebelink:Stephen, if you could impart just one lesson to founders
who are five years behind you, what would it be?
Stephen de Vries:Don't think that it's something that you need somebody
else to get to do. You can do it yourself. And you can do it. If you're doubting
whether you're right for the role, you're fine. You're right for the role. Go
and do it and see what happens. I'm sure you'll find something in yourself that
will pull you through.
Roland Siebelink:That's awesome. Very good closing words. Thank you so
much, Stephen de Vries, the CEO and founder of IriusRisk. And thank you, Carlos,
for joining us as a co-host this week on the Midstage Startup Momentum Podcast.
Thank you, everyone, for listening.
Roland Siebelink talks all things tech startup and bring you interviews with tech cofounders
across the world.